CVE-2017-6306
HighSummary
An issue was discovered in ytnef before version 1.9.1 related to directory traversal using the filename, associated with the SanitizeFilename function in settings.c.
Risk Assessment
An attacker could exploit this vulnerability to gain unauthorized access to files on the system, potentially leading to the exposure of sensitive data.
Recommendation
It is recommended to update ytnef to version 1.9.1 or later to mitigate this vulnerability.
Other vulnerabilities in ytnef
See all- CVE-2017-6802High
An issue was discovered in ytnef before 1.9.2 related to a potential heap-based buffer over-read on incoming Compressed RTF Streams, concerning the DecompressRTF() function in libytnef.
- CVE-2017-6801High
An issue was discovered in ytnef before version 1.9.2, which may lead to out-of-bounds access due to fields of Size 0 in TNEFParse() in libytnef.
- CVE-2017-6800High
An issue was discovered in ytnef before 1.9.2. An invalid memory access (heap-based buffer over-read) can occur during handling of LONG data types, related to MAPIPrint() in libytnef.
- CVE-2017-6305High
An issue was discovered in ytnef before version 1.9.1 related to a patch described as '8 of 9. Out of Bounds read and write.'
- CVE-2017-6304High
An issue was discovered in ytnef before version 1.9.1 related to a patch described as '7 of 9. Out of Bounds read.'
- CVE-2017-6303High
An issue was discovered in ytnef before version 1.9.1 related to invalid write and integer overflow, which may lead to unauthorized access or data corruption.
- CVE-2017-6302High
An issue was discovered in ytnef before version 1.9.1 related to an integer overflow, described as '5 of 9'.
- CVE-2017-6301High
An issue was discovered in ytnef before version 1.9.1 related to out of bounds reads.
- CVE-2017-6300High
An issue was discovered in ytnef before 1.9.1 related to a buffer overflow in the version field in lib/tnef-types.h.
- CVE-2017-6298High
An issue was discovered in ytnef before version 1.9.1 related to null pointer dereference and unchecked return value from calloc.
Original NVD description (English source)
An issue was discovered in ytnef before 1.9.1. This is related to a patch described as "9 of 9. Directory Traversal using the filename; SanitizeFilename function in settings.c."